GRC Report Staff

For a long time, deleting data could feel strangely reckless. Storage was cheap, and information was potentially valuable. The cost of keeping another year of customer records, internal correspondence, transaction histories or old documents was difficult to see, while the cost of deleting the wrong thing was easy to imagine. So companies kept it. Some of it was retained for legal or operational reasons, some because nobody was quite sure whether it could safely be destroyed, and some because of the most durable retention policy in corporate life: we might need it someday.

Poland’s consumer protection authority has opened proceedings against parcel-shipping platform Furgonetka over contract terms that allow additional charges to be imposed after delivery and require consumers to pursue complaints through carriers with which they have no contract.

The Malta Financial Services Authority worked through 943 potential enforcement cases in 2025. Ninety-one ended in enforcement actions and administrative penalties totaling €570,673, but the clearest pattern in the regulator’s year was not buried in its more complicated investigations. It was there in the calendar.

For more than two years, City Beach sold toys, keyrings, digital notepads, lights and other products containing button batteries that did not meet Australia’s mandatory safety rules. There were more than 54,000 sales in all. Many of the products were meant for children. The bill for that failure remains $9.9 million (AUD 14 million).

Ten major Australian banks went looking through their mortgage books together. What they found was not a handful of suspicious applications sitting neatly inside one institution, but the outlines of potentially hundreds of millions of dollars in suspected fraudulent loans, recurring across lenders and concentrated largely in Sydney property.

A consumer looking to pay a utility bill or car loan might reasonably assume that typing the biller's name into a search engine and clicking on a result would take them where they needed to go. The Federal Trade Commission says Doxo found a profitable place inside that assumption.

The SEC on Tuesday proposed “Regulation Crypto Assets,” a new framework that would give issuers of certain investment contracts involving crypto assets two purpose-built ways to raise capital without registering the offering under the Securities Act of 1933. One would allow up to $5 million to be raised over four years. The other would permit as much as $75 million in each 12-month period.